linux-kernel - Re: [PATCH v2 3/4] i2c: rtl9300: Add missing count byte for SMBus Block Ops

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <cea34edf-ece8-48a3-a8b9-c0f7e6415886@alliedtelesis.co.nz>
Date: Sun, 3 Aug 2025 22:38:34 +0000
From: Chris Packham <Chris.Packham@...iedtelesis.co.nz>
To: Sven Eckelmann <sven@...fation.org>, Andi Shyti <andi.shyti@...nel.org>
CC: "linux-i2c@...r.kernel.org" <linux-i2c@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>, Jonas Jelonek
	<jelonek.jonas@...il.com>, Harshal Gohel <hg@...onwunderlich.de>, "Simon
 Wunderlich" <sw@...onwunderlich.de>, "stable@...r.kernel.org"
	<stable@...r.kernel.org>
Subject: Re: [PATCH v2 3/4] i2c: rtl9300: Add missing count byte for SMBus
 Block Ops

Hi Sven, Andi,

On 04/08/2025 04:54, Sven Eckelmann wrote:
> The expected on-wire format of an SMBus Block Write is
>
>    S Addr Wr [A] Comm [A] Count [A] Data [A] Data [A] ... [A] Data [A] P
>
> Everything starting from the Count byte is provided by the I2C subsystem in
> the array data->block. But the driver was skipping the Count byte
> (data->block[0]) when sending it to the RTL93xx I2C controller.
>
> Only the actual data could be seen on the wire:
>
>    S Addr Wr [A] Comm [A] Data [A] Data [A] ... [A] Data [A] P
>
> This wire format is not SMBus Block Write compatible but matches the format
> of an I2C Block Write. Simply adding the count byte to the buffer for the
> I2C controller enough to fix the transmission.
>
> This also affects read because the I2C controller must receive the count
> byte + $count * data bytes.
>
> Cc: <stable@...r.kernel.org>
> Fixes: c366be720235 ("i2c: Add driver for the RTL9300 I2C controller")
> Signed-off-by: Sven Eckelmann <sven@...fation.org>

This conflicts with commit f46867c08a22 ("i2c: rtl9300: Fix 
out-of-bounds bug in rtl9300_i2c_smbus_xfer") which didn't get a Fixes 
tag. The merge conflict is reasonably straight forward to resolve. Not 
sure how you want to handle the patch for stable.

> ---
>   drivers/i2c/busses/i2c-rtl9300.c | 6 +++---
>   1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/i2c/busses/i2c-rtl9300.c b/drivers/i2c/busses/i2c-rtl9300.c
> index a10e5e6e00075fabb8906d56f09f5b9141fbc06e..4e0844d97607f64386a6d7a7c4086a81fdd89d6c 100644
> --- a/drivers/i2c/busses/i2c-rtl9300.c
> +++ b/drivers/i2c/busses/i2c-rtl9300.c
> @@ -284,15 +284,15 @@ static int rtl9300_i2c_smbus_xfer(struct i2c_adapter *adap, u16 addr, unsigned s
>   		ret = rtl9300_i2c_reg_addr_set(i2c, command, 1);
>   		if (ret)
>   			goto out_unlock;
> -		ret = rtl9300_i2c_config_xfer(i2c, chan, addr, data->block[0]);
> +		ret = rtl9300_i2c_config_xfer(i2c, chan, addr, data->block[0] + 1);
>   		if (ret)
>   			goto out_unlock;
>   		if (read_write == I2C_SMBUS_WRITE) {
> -			ret = rtl9300_i2c_write(i2c, &data->block[1], data->block[0]);
> +			ret = rtl9300_i2c_write(i2c, &data->block[0], data->block[0] + 1);
>   			if (ret)
>   				goto out_unlock;
>   		}
> -		len = data->block[0];
> +		len = data->block[0] + 1;
>   		break;
>   
>   	default:
>